Enterprise IAM Security Engineer

Opendoor; Toronto; On-site; CAD 120,000 - 180,000; Full time

Job summary

Opendoor is seeking a Security Engineer to own the identity platform that governs access for our workforce. You will design and operate authentication and authorization systems at scale, including passkeys and policy-driven sessions.

You will implement identity tooling with IaC, automate integration with Okta, and advance secure-by-default standards while mentoring other engineers across security and IT.

Qualifications

• Design, build and operate workforce identity platforms at enterprise scale.
• Shipped passkey/WebAuthn adoption in large environments.
• Written and reviewed IaC changes (Terraform or equivalent) for identity systems.
• Strong software engineering ability in Python, Go, or TypeScript for tooling.
• Experience with SSO, SAML, OIDC, and SCIM provisioning at scale.

Responsibilities

• Own the identity control plane end to end including authentication and authorization for employees and contractors.
• Define enrollment rules for authentication methods and policy surface.
• Design session policies and risk-based re-authentication thresholds.
• Build per-application authentication policies considering device posture and network context.
• Mentor engineers on identity engineering patterns and guardrails.

Skills

Identity engineering

Okta platform

Terraform IaC

Python/Go/TypeScript

SSO/SAML/OIDC/SCIM

Automation & tooling

Ambiguity navigation

Tools

Okta

Terraform

APIs

Google Workspace automation

Job description

At Opendoor our mission is to tilt the world in favor of homeowners and those who aim to become one. Homeownership matters. It's how people build wealth, stability, and community. It's how families put down roots, how neighborhoods strengthen, how the future gets built. We're building the modern system of homeownership giving people the freedom to buy and sell on their own terms. We’ve built an end-to-end online experience that has already helped thousands of people and we’re just getting started.

About the role

Our Security Engineering team builds intelligent systems that protect Opendoor and our customers while enabling unprecedented engineering velocity. We apply software engineering and AI to solve security problems across product, infrastructure, and operations, building guardrails precisely where they matter.

Identity is the front door to every system an employee or contractor touches, and this role owns it. You design and build the platform that decides who gets access to what, and you write the code that runs it. You own the technical direction for identity and build alongside peer specialists covering the rest of the enterprise security surface.

What you'll do

• Own the identity control plane end to end, working alongside peers who own other parts of the enterprise security surface: design, build, and operate the systems that authenticate and authorize every employee and contractor.
• Own passwordless authentication (e.g. passkeys) for the workforce, across employee and contractor identities.
• Define enrollment rules for which authentication methods are required, optional, or disallowed by population, setting the assurance bar before a user ever reaches session or app-level policy.
• Design authenticator assurance tiers and tune session policy: session lifetime, idle timeout, and step-up re-authentication scaled to the risk of what's being accessed.
• Build per-application authentication policies that weigh device posture, network context, and risk signals to decide when a phishing-resistant factor or a fresh re-authentication is required, with a fast exception path for when a legitimate user gets stuck.
• Own the non-human identity inventory: service accounts, API keys, and workload identities, each tracked, owned, and issued short-lived, federated credentials with automatic expiry.
• Treat AI agents as their own identity class: scoped, single-use credentials per action, clear delegation from the human or system they act for, and an audit trail granular enough to attribute every individual action.
• Manage identity configuration as code, shipping and reviewing every change through pull requests, so a bad policy change is as easy to revert as it was to ship.
• Build first-party tooling that extends commercial identity platforms: lifecycle automation, access governance workflows, provisioning, and custom integrations across the workforce SaaS stack.
• Own the technical direction for identity, contribute to the broader security engineering roadmap, and ship the critical infrastructure that strengthens the security posture.
• Feed high-fidelity identity telemetry, auth events, anomalous access, lifecycle changes, into the detection and response pipeline, and support incident response when identity is in the blast radius.
• Establish secure-by-default standards for new SaaS and AI tools employees adopt, enforced directly at the identity layer.
• Mentor engineers across security and IT on identity engineering patterns; build automation and guardrails other teams build on top of.

What you'll need

• Deep conviction that AI and automation should eliminate manual work, with a proven track record building agentic systems.
• Has designed, built, and operated a workforce identity platform at enterprise scale, with deep hands-on Okta engineering expertise: building automation and API-driven integrations on top of the platform.
• Has shipped a passkey rollout on Okta at enterprise scale, and knows where WebAuthn and FIDO2 adoption breaks in the real world and how to fix it.
• Manages identity infrastructure as code: writes and reviews Terraform, or an equivalent IaC tool, for identity systems, and ships changes through pull requests.
• Strong software engineering ability in Python, Go, or TypeScript, building first-party tooling and API-driven automation on top of the identity platform.
• Identity-first mindset: SSO, SAML, OIDC, and SCIM provisioning, conditional access, and least privilege applied at scale, across both employees and contractors.
• High autonomy; sets the roadmap and the right path forward in ambiguous territory, and personally executes against it.
• Business-enablement mindset; success measured by adoption and impact.
• Humility and curiosity; builds guardrails and automation that make it easier for other teams to move fast securely.

Nice to have

• Hands-on Google Workspace administration and automation (Admin SDK, directory sync, DLP) alongside Okta.
• Experience tying device trust or posture signals to access decisions, identity-aware proxy patterns.
• SOC 2 or SOX access-control evidence experience.
• Contributions to open source identity tooling or the Okta Terraform provider ecosystem.

Location

This role is based in one of our offices, in-person four days per week. We're looking for candidates who are enthusiastic about an in-office culture; people who want to build alongside their teammates, not from a distance.